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Amendments to the Drawings: 

Please substitute the attached two sheets (containing Figures 1, 2, 3, and 4) of formal 
drawings for the drawings originally filed with the application. The replacement drawings are 
appended to the end of this document. 

The specific changes which have been made to the Figures 1, 2, and 4 are to substitute 
the web address "quart.com" for the web address "abc.com" throughout these figures in 
compliance with a requirement from the Examiner that there be no active hyperlinks in the 
specification and drawings. These changes bring the drawings into agreement with the changes 
made to paragraphs 21, 29, and 36 of the specification in response to the same requirement of the 
Examiner. 
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REMARKS 

This amendment is submitted in response to the Office Action mailed on November 12, 
2005, In view of the above amendments and the reasons set forth below, Applicant respectfully 
requests reconsideration and allowance of the present application. 

A. Corrections Made to the Claims to Improve Their Readability 

As the Examiner has required, all of the claims have been set forth in this amendment 
with their lines numbered beginning with the first line of each claim, and the status of each claim 
is indicated in a parenthetical following the claim number of each claim. 

Applicant has also amended most of the claims in an effort to achieve a higher degree of 
consistency, uniformity, and clarity in the language of the claims. For example, prior to this 
amendment method claim 1 spoke of "eliminating invalid ... data" in is preamble, while it spoke 
of "causing ... invalid data ... to be neutralized" in its final paragraph. Now claim 1 speaks of 
"neutralizing invalid ... data" in its preamble and of "causing ... invalid data ... to be neutralized" 
in its final paragraph. A similar correction has been made to claim 13. As another example, all 
of the claims now use the term "client" (meaning a computer operating as a client with respect to 
another computer operating as a server) whereas previously some claims used the term "client" 
while others used one of the terms "client machine" or "client web machine" or "web browser." 
As another example, all of the claims as amended now speak of "data" associated with an 
"identifier" both of which were sent to a client by a server on an earlier occasion, whereas 
previously some claims used the phrase "server data" while others used the phrase "data values," 
and the term "name" was sometimes used instead of the term "identifier." Approval of these 
amendments, intended to improve the consistency, uniformity, and clarity of the claims, is 
respectfully requested. 
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B. Corrections made to the Specification 

a. Spelling Errors and Other Minor Defects 

In the specification, a number of paragraphs (20, 21, 25, 27, and 45) have been amended 
to correct spelling errors and other minor defects. Approval of these minor changes (which add 
no new matter) is respectfully requested. 

b. Hyperlinks 

The examiner has objected to the presence of hyperlinks in the specification, pointing out 
the quoted phrase "www.abc.com" which appears in paragraph 21 on page 5 of the specification. 
This was not intended to be an actual hyperlink; it is simply an example of a web address that is 
included in the specification in order to meet the requirements of 35 USC §112, first paragraph. 
Applicant does not intend to have this nor any other hyperlink, URL, or similar phrase in the 
specification be active links that incorporate Internet documents by reference into the 
specification. 

To emphasize that these phrases are not intended to be active links, applicant has 
amended paragraphs 21, 29, and 36 of the specification and also figures 1. 2, and 4 of the 
drawings to refer to the fictitious and non-existent web site "www.quert.com" rather than to 
"www.abc.com" which, inadvertently, turned out to be an actual web site. 

While 37 USC § 1.57(d) does prohibit incorporation by reference into a patent application 
through the use of embedded hyperlinks, this rule is not applicable to the phrase 
"www.quert.com" as used in the present application. Section 608.01 VII of the MPEP says: 

... Where the hyperlinks and/or other forms of browser-executable codes 
themselves rather than the contents of the site to which the hyperlinks are directed are 
part of applicant's invention and it is necessary to have them included in the patent 
application in order to comply with the requirements of 35 U.S.C. 1 12, first paragraph, 
and applicant does not intend to have these hyperlinks be active links, examiners should 
not object to these hyperlinks. ... 
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Accordingly, applicant's inclusion in the illustrative examples of the invention presented 
in the specification of the dummy and unworkable web address "www.quert.com" which is a 
necessary part of the teachings of the invention and which is clearly not intended to be used to 
incorporate anything by reference is in compliance with the rules. Approval of the specification 
and drawings as amended in this regard is respectfully requested. 

C. Rejection of the Claims under 35 USC § 102(e) and S 103(a) 

The Examiner has rejected independent claims 1 and 13 and dependant claims 2-5, 12, 
and 14-17 as unpatentable under 35 USC § 102(e) in view of the published U.S. Patent 
Application No. 2002/0019879 of Mark Jasen, et aL 9 published on Feb. 14, 2002, filed originally 
on May 15, 2001, and claiming the priority of provisional application No. 60/204,240 which was 
filed on May 15,2000. 

The Examiner has rejected the remaining dependant claims 6-11 and 18-24 as 
unpatentable under 35 USC § 103(a) in view of the combination of the Jasen, et al patent and an 
Internet publication entitled "Fundamentals of Java Servlets: The Java Servlet API" published 
by the MageLang Institute in 1999. Applicant has found a Web document approximately 30 
pages in length which appears to be the publication cited by the Examiner. 

Reconsideration and allowance of all the claims, as amended, is respectfully requested in 
view of the amendments and the remarks that follow. 

D. Claims 1, 8, 13, and 20 Are Patentable 

Applicant has amended independent claims 1 and 13 to clarify the meaning of the phrase 
"invalid data" as used in the claims. Independent Claim 1 now reads in part: 

1. ... scanning the data which is received from the client to identify , as invalid data , any 
data that includes improper characters ; ... 

Independent Claim 13 has been similarly amended to read: 
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13. ... a data integrity tester that tests the validity of such incoming data by searching the 
data for improper characters ; ... 

These two amendments make it clear that the validity test is limited to a test that determines 
whether any improper characters are present. The term "improper characters" is defined in the 
specification as follows: 

[0033] ... [T]here are restrictions on which characters may appear within 
the value portion of a Version 0 cookie. The following characters should 
not appear within the value portion of such a cookie: space, beginning 
bracket, end bracket, beginning curly brace, end curly brace, beginning 
parenthesis, end parenthesis, question mark, plus sign, colon, semi-colon, 
comma, equal sign, at sign, forward slash, backward slash, and quotation 
mark 

* * * * 

[0042] The improper characters are the ones listed above (space, equal 
sign, etc.).... [Emphasis added.] 

Clearly, then, the validity test called for by the claims is a test of whether the data portion 
of a Cookie (or of some other server-originated data associated with an identifier and stored on 
and later returned by a client) contains any illegal and improper characters the presence of which 
renders the data invalid. This is a test of the form and validity of the data, and not as to the 
authenticity of the data. The claims call for a test that can be carried out simply by examining 
the Cookie data itself, without reference to any other data or to any external database (other than 
to the invariant rule that certain characters are prohibited from appearing in Cookies). For 
example, if a Cookie's data portion contains a slash character, then the Cookie's data is invalid. 
End of test. 

Dependant claims 8 and 20 already contain similar limitations to these. These claims 
define "invalid data" to be "data all of whose characters should correspond to one or more 
printable characters but some of whose characters match characters contained in a list of invalid 
characters." Accordingly, it make sense to discuss all of the claims 1, 8, 13, and 20 together. 

1. Claims 1,8, 13, and 20 Are Patentable Over Jasen, et al. 
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No such validity test for the presence of improper characters (such as a slash character) is 
taught nor performed in the Jasen, et al application. Jasen et al. simply presumes all the data is 
valid in form and then looks up the data in an externally maintained and updated table or 
database the contents of which change over time. This test in Jasen, et al. is a test of the 
authenticity of the data - a test that determines whether the one possessing the data is authorized 
to do something or to have some privilege, not whether the data itself is valid as to its form. The 
Jasen, et al. test is analogous to the authenticity test performed by a policeman when he or she 
looks up someone's driver's license number in a state's central computer to find out whether the 
person holding the license is authorized to drive. Contrary to this authorization test, the claims 
before the Examiner call for a test of whether the data is valid in form without regard to any 
possible meaning that may be attributed to the data. 

The Jasen, et al patent teaches a way in which certain selected users of an Internet-based 
service such as online stock brokerage (see Jasen, et al, paragraph [0017] ) may be given much 
faster and better service than other users of that same service. The patent teaches that most 
users, by default, automatically access a server's normal, default TCP Port (for example, the Port 
8080 - see paragraph [0027] ). When many users access this same port on the same server, 
performance suffers - the service slows down. The patent teaches that users who have paid for 
premium service, or who are otherwise privileged, are to be granted access to the server through 
different TCP Ports (see Jasen, et al, paragraph [0016]). For example, the patent teaches 
allowing "Gold prioritization level traffic" to use the least busy Port 9190 while "Silver 
prioritization level traffic" is allowed to use the next least busy Port 9290, and so on. (Jasen, et 
al, paragraph [0027] ) 

The Jasen, et al system, a "network traffic management (NTM) system," includes a 
server component and a client component. (Jasen, et al, paragraph [0018] ) When the user first 
contacts an NTM server, the server downloads and installs the client component and "one or 
more new coupons" onto the user's PC. The coupons indicate a user's assigned priority. The 
server may send out data that is to be placed into the coupons on the client PC contained within 
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Cookies. This Cookie information is first sent to the user's PC and is then translated and 
mapped into the coupons. (See the end of Jasen, et al., paragraph [0059] ) (There is no other 
mention of Cookies in the Jasen, et al. patent.) 

Contrary to the teachings of the present invention, the Jasen, et al., patent does not teach 
checking these "coupons" for validity of form by checking them for the presence of erroneous 
characters, such as the slash character. The Jasen, et al. server never checks coupon data for bad 
characters, a test that would signal when the data is improperly formulated and thus invalid. The 
specific test performed by the server in Jasen, et al. is described in the following paragraph of the 
patent: 

[0024] ... If the NTM client and/or coupon(s) have been revoked or the 
NTM client is unlicensed, a denial acknowledgment denying NTM prioritization 
is returned ... to the NTM client and the sending and receiving of network traffic 
by a user proceeds without NTM prioritization.... 

The Jasen, et al. server thus looks up the coupon data in a central database (the content of 
which varies over time) to see whether the user is authorized to have priority access. 

There is a big difference between rejecting data as invalid (as the present invention 
teaches) because the data is improperly formatted and contains invalid characters (such as the 
slash character) and rejecting data as unauthorized (as the Jasen, et al. patent teaches) because 
the data is found to contain the identifying number of a user whom an external database indicates 
is not authorized to receive some type of premium service. These are entirely different types of 
tests. 

In conclusion, independent claims 1, 8, 13, and 20 all call for a format validity test, not 
an authorization test such as that taught by the Jasen, et al. patent. This format validity test 
checks to see if the data contains any impermissible characters such as slashes. These claims are 
clearly patentable because they call for a validity test that checks for impermissible characters ; 
and the remaining dependant claims are patentable because they are all dependant upon 
allowable claim 1 or upon allowable claim 13. 
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2. Independent Claims 1 and 13 and Dependant Claims 8 and 20 Are Patentable 
Over the Combination of Jasen, et al. with "Fundamentals of Java 
Servlets: The Java Servlet API" (MageLang Inst., 1999) 

Since claims 1 and 13, as amended, are now similar in scope to dependant claims 8 and 
20, which the Examiner has rejected under Section 103 as unpatentable in view of the above 
combination of references, the Examiner may consider rejecting claims 1 and 13 as well as 
claims 8 and 20 under Section 103. The following remarks make it clear that all four of these 
claims are patentable over this combination of references. 

The Examiner (Office Action mailed on 1 1/21/2004, page 6, paragraph 18) concedes that 
Jasen, et al does not teach testing for invalid characters, as claims 1,8, 13, and 20 require. 
Accordingly, the Examiner, in his rejection of claim 8, cites pages 6 and 9 of "MageLang" 
reference. The Examiner maintains that this publication teaches that "invalid data comprises 
data whose value corresponds to one or more printable character identification codes which 
match codes contained in a list of invalid character codes." 

Applicant has studied this publication, but has been unable to find any such teaching on 
pages 6 and 9 of this publication. The teachings focusing upon "Using Cookies" that appears on 
pages 22 and 23 of this publication, and that the Examiner has relied upon elsewhere in the 
Office Action, contain no such teachings. Accordingly, applicant must respectfully object on the 
grounds that the Examiner has not clearly cited an identifiable passage in a valid publication 
against these two claims - the teachings simply cannot be found by applicant. 

This publication is entitled, "Fundamentals of Java Servlets: The Java Servlet API." It 
thus teaches one how to write programs in a programming language named Java. Any such 
program language manual is likely to say at some point that those writing, for example, a Java 
servlet program may not use certain improper characters when writing out a line of Java program 
code. 
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Assuming for the sake of argument that such a teaching can be found in this program 
language manual, applicant submits that there is no suggestion in either this program language 
manual nor in the Jasen, et al patent that the teachings of these two references are combinable. 
A directive to a Java programmer to avoid improper characters when writing Java programs is 
simply not relevant to a system designer who plans to use a server to test data to determine 
whether a user is authorized to receive some priority service. These two references relate to two 
entirely different subjects: program writing on the one hand and the design of a server-based 
user authorization system on the other hand. Program writing is done by programmers when a 
program is being written, whereas tests of user authorization such as those taught in the Jasen, et 
al patent are incorporated into a system's high-level design specifications and have nothing 
whatsoever to do with the grammar of a particular programming language. Applicant submits 
that these two references simply cannot be combined to form a valid Section 103 rejection. 

Accordingly, claims 1, 8, 13, and 20 are believed to be patentable over this combination 
of references. 

D. The Independent Claims Are Also Allowable 

1 . Claims 2, 9- 1 1 , 1 4, and 2 1 -24 Are Allowable 

Claims 2, 9-1 1, 14, and 21-24 are limited to the validity test being performed upon 
Internet web browser Cookies. The Jasen, et al patent, as explained above, does not teach 
having a server examine the data contents of Cookies returned to the server by a client computer. 
Jasen, et al speaks only of Cookies being used as vehicles to send information to a client 
computer where that information is translated and then transferred into a "coupon." (See the end 
of Jasen, et al, paragraph [0059] ). There is no other mention of Cookies in the Jasen, et al. 
patent other than this use of cookies to convey data outwards from a server to a client and then 
into coupons following translation. This patent does not teach using Cookies to convey data 
back from the client to the server, and it does not teach checking Cookie data for improper 
characters, nor does it teach neutralizing only Cookies that contain improper characters. 
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Applicant submits that after such "translation" into some other format, it is almost 
certainly going to be impossible to test the data previously conveyed by Cookies for "improper 
characters" (such as the slash character), since the format of the data after translation is different. 
In Jasen, et al., only the translated coupon information is returned to the server, where it is tested 
only for authorization, not for format validity and for improper characters, as has been explained 
above. Accordingly, the Jasen, et al patent does not teach having a server test Cookie data 
returned by a client computer for validity by testing the data for the presence of "improper 
characters." 

2. Claims 3 and 15 Are Allowable 

Note that these two claims have been amended so that they now require the client to 
return two or more separate identifiers and associated data, and they now require the server to be 
capable of neutralize less than all of the data that was returned. 

Claims 3 and 15 require a client to return two or more identifiers and their associated data 
to a server as part of "a request for services." The server checks for improper characters, and 
then it neutralizes data that contains improper characters. Other data is not neutralized. In 
contrast to this, the Jasen, et al. patent teaches only that the user is either authorized to gain 
higher-speed access to some Internet service, or the user is not authorized to gain such higher- 
speed access. Jasen, et al. does not teach neutralizing some data but not other data. Hence, 
claims 3 and 15, as amended, are patentable. 



3. Claims 4-7 and 16-19 Are Allowable 

These claims focus in upon the specific way in which neutralization of invalid data on the 
client computer is achieved. The Examiner has rejected claims 4-5 and 16-17 under Section 
102(e) in view of Jasen, et al., and he has rejected the claims 6 and 7 (dependant upon claim 5) 
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and 18 and 19 (dependant upon claim 17) under Section 103(a) in view of Jasen, et al. in 
combination with a passage on Cookies in the MagLang Institute publication (pages 22 and 23) 
explaining how and when Cookies are deleted. (Briefly summarized: the publication says 
Cookies are deleted immediately if the "expires" value is set to zero; they expire "when the 
browser exits" if the "expires" value is negative, which "is the default;" and they endure for 
whatever time is specified if the "expires" value is positive). 

Claims 4 and 16 have both been amended. As amended, they both teach neutralizing the 
data by returning to the client a null (or empty) data string. The Examiner says that Jasen, et al. 
teaches sending the client a new data set "containing no erroneous data." (Office action mailed 
on 1 1/21/2005, page 4, paragraph 10) In paragraph [0033] of Jasen, et al. (the paragraph cited 
by the Examiner in this regard), the patent speaks of either sending out a "new" coupon (with 
new data, not a null or empty data string), "updating" the coupon (with new data that is not a null 
or empty data string) or "deleting" the coupon (which also is not updating the coupon with a null 
or empty data string). None of these three procedures taught by Jasen, et al. is equivalent to 
returning to the client a null or empty data string, as is now required by these two claims. 

Claims 5-7 and 17-19 teach neutralizing the data by returning to the client data that 
contains an expiration date set to a value that "neutralizes the invalid data through expiration" 
(claims 5 and 17). Claims 6 and 18 set the expiration date to zero, while claims 7 and 19 set the 
expiration date to a date equal to or earlier than the date when the command conveying this date 
information back to the client is sent out. 

Claims 5 and 17 have been amended so that they now call for "expiration shortly after the 
commands are received ." The Examiner points out that the coupons of Jasen, et al. are time and 
date stamped and expire upon a certain date, and applicant concedes that this is true. 
Nonetheless, applicant submits that these teachings of Jasen, et al teach only that a coupon may 
be set to expire at some future time or on some future date, but only after the coupon has been 
used for a significant length of time - long enough for the client to gain some advantage from the 
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priority service authorized by the coupon. These teachings do not teach that the coupons must 
expire shortly after the date altering commands are received by the client computer, as all of 
these claims now require. 

Claims 6 and 7 and claims 18 and 19, which specifically call for the expiration date to be 
set to zero or to an earlier date than the date when the command to alter the date is sent out, are 
allowable since they depend upon allowable claims 5 and 17, adding further details to those 
claims. 

4. Claim 12 Is Allowable 

Claim 12, which is directed to a program that performs the method steps outlined in 
claim 1 which claim 12 incorporates by reference, is allowable because it is dependant upon 
allowable claim 1. 

E. Conclusion 

Applicant believes that the present application is now in condition for allowance. 
Favorable reconsideration of the application as amended is respectfully requested. 

The Examiner is invited to contact the undersigned by telephone if it is felt that a 
telephone interview would advance the prosecution of the present application. 

The Commissioner is hereby authorized to charge any additional fees which may be 
required regarding this application under 37 C.F.R. § § 1 . 1 6- 1 . 1 7, or credit any overpayment, to 
Deposit Account No. £8-2025. Should no proper payment be enclosed herewith, as by a check 
being in the wrong amount, unsigned, post-dated, otherwise improper or informal or even 
entirely missing, the Commissioner is authorized to charge the unpaid amount to Deposit 
Account No. 08-2025. If any extensions of time are needed for timely acceptance of papers 
submitted herewith, Applicant hereby petitions for such extension under 37 C.F.R. §1.136 and 
authorizes payment of any such extensions fees to Deposit Account No. 08-2025. 
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Date M/zi7zoo6 

FOLEY & LARDNER LLP 
321 North Clark Street, Suite 2800 
Chicago, IL 60610-4764 
Telephone: 3 12-832-4586 

(Attorney Michael D. Rechtin) 
Facsimile: 3 12-832-4700 



Respectfully submitted, 




Attorney for Applicant 
Registration No. 25,061 

Tel 847-446-7399 
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